Australia's privacy regulator received 1,205 data breach notifications in 2025, the highest annual total since the Notifiable Data Breaches (NDB) scheme began in 2018, according to the Office of the Australian Information Commissioner's July 2026 statistics release. That is an 8% increase over 2024's 1,112 notifications, and it continues a climb that has run every year since 2022.
How many data breaches were reported in Australia in 2025?
1,205 notifications reached the OAIC across the 2025 calendar year, up 8% from 1,112 in 2024, per the regulator's July 2026 release. Businesses and Commonwealth government agencies covered by the Privacy Act must report any breach likely to cause serious harm, so the count reflects confirmed notifications rather than every incident that occurs.
Figure 1: Australia recorded 1,205 data breach notifications in 2025, the highest since mandatory reporting began. Source: Office of the Australian Information Commissioner, July 2026 statistics release.
Australian Privacy Commissioner Carly Kind called the growth "substantial and rising year on year" when the figures were published, and the pace has not slowed in any of the last three reporting years.
How has the number of data breaches in Australia grown each year?
Annual notifications rose from 882 in 2022 to 1,205 in 2025, a 37% increase over three years, according to OAIC semi-annual and annual reports compiled through 2026. The growth has not been steady: 2023 barely moved past 2022's total, while 2024 jumped 25% in a single year before 2025 added another 8% on top of that.
Figure 2: OAIC data breach notifications, Australia, 2022 to 2025. Source: OAIC Notifiable Data Breaches reports, compiled by PrivacyTerms.io.
For how Australia's breach volume compares with reporting from other countries, see our global data breach statistics for 2026.
What causes most data breaches in Australia?
Malicious or criminal attacks caused 716 of the 1,205 notifications the OAIC received in 2025, a 59% share, making cyber hacking the leading cause by a wide margin. The OAIC's July 2026 release did not break the full 2025 year down further into human error and system fault, so the most recent complete three-way split comes from the July to December 2024 report: malicious or criminal attacks accounted for 69% of that period's 595 notifications, human error for 29%, and system fault for 2%.
Figure 3: Cause of Australian data breaches, July to December 2024, the most recent period with a full three-way source breakdown published. Source: OAIC Notifiable Data Breaches Report, July to December 2024.
An outdated or vague privacy policy will not stop a criminal attack, but it does shape how quickly a business can explain, to both the OAIC and affected individuals, what data was involved and why. A privacy policy generator built for the Australian Privacy Act keeps that disclosure current instead of leaving it to be drafted for the first time under pressure.
Which sectors report the most data breaches in Australia?
Health service providers reported 225 notifications in 2025, 19% of the national total, more than any other sector. Financial services followed with 157, the Australian Government with 118, business and professional associations with 103, and education and legal, accounting and management services tied at 81 each, according to the OAIC's July 2026 release.
Figure 4: Top sectors reporting data breaches, Australia, 2025. Source: OAIC, July 2026 statistics release.
Health has topped this ranking in every OAIC reporting period since the scheme began, a pattern that tracks the sensitivity and volume of the records the sector holds rather than any single incident.
How concerned are Australians about data breaches?
82% of Australians identify data breaches as their top privacy concern, up from 74% in 2023, according to the OAIC's 2026 Australian Community Attitudes to Privacy Survey (ACAPS). Public concern has tracked the rise in actual notifications closely over the same three years.
Figure 5: Share of Australians who say they are concerned about data breaches, 2026. Source: OAIC, 2026 Australian Community Attitudes to Privacy Survey.
Regulator activity and public sentiment are moving in the same direction, which raises the practical cost of a slow or unclear breach response for any business covered by the Privacy Act.
How does Australia's 2025 breach count compare to prior years?
| Year | Notifications | Change vs. prior year |
|---|---|---|
| 2022 | 882 | -- |
| 2023 | 890 | +1% |
| 2024 | 1,112 | +25% |
| 2025 | 1,205 | +8% |
Source: OAIC Notifiable Data Breaches reports, compiled by PrivacyTerms.io.
Four straight years without a decline means 2025's 1,205 notifications are not a one-off spike. They are the latest point on a trend line that has run in only one direction since 2022.
The Bottom Line
1,205 data breach notifications in a single year is the clearest signal yet that Australia's NDB scheme is catching more incidents, not fewer. Malicious and criminal attacks remain the dominant cause at 59% of 2025's total, health service providers remain the most exposed sector, and public concern has climbed alongside the notification count itself. A current privacy policy will not prevent a criminal attack, but it does determine how fast a business can respond when the OAIC or an affected individual comes asking what happened. Keeping that disclosure accurate with a privacy policy generator built for Australian requirements is one of the few parts of breach response a business can settle well before it needs it.
Frequently Asked Questions
How many data breaches were reported in Australia in 2025? 1,205 data breach notifications, according to the Office of the Australian Information Commissioner, an 8% increase over the 1,112 notifications recorded in 2024 and the highest annual total since the Notifiable Data Breaches scheme began in 2018.
What is the leading cause of data breaches in Australia? Malicious or criminal attacks, which accounted for 716 of the 1,205 notifications the OAIC received in 2025, a 59% share, according to the OAIC's July 2026 statistics release.
Which industry reports the most data breaches in Australia? Health service providers, with 225 notifications in 2025, 19% of the national total, ahead of financial services at 157 and the Australian Government at 118, per the OAIC.
How many Australians are concerned about data breaches? 82% of Australians say data breaches are their top privacy concern, up from 74% in 2023, according to the OAIC's 2026 Australian Community Attitudes to Privacy Survey.
Where the Numbers Come From
- Office of the Australian Information Commissioner. (2026). "Data breach notifications increase to all-time high in 2025, new NDB stats show." Published July 6, 2026. Source of the 1,205 total, the 8% year-over-year change, the 716 malicious-attack count, and the 2025 sector breakdown.
- Office of the Australian Information Commissioner. (2025). "Notifiable Data Breaches Report: July to December 2024." Source of the 595-notification period total and the 69/29/2 malicious-attack, human-error, system-fault split used for the cause breakdown.
- Office of the Australian Information Commissioner. (2024). "Notifiable Data Breaches Report: July to December 2023." Source of the 890 full-year 2023 total used in the annual trend.
- Office of the Australian Information Commissioner. (2022). "Notifiable Data Breaches Report: January to June 2022." Source of the 396-notification period total used to calculate the 882 full-year 2022 total in the annual trend.
Note: All figures verified as of August 2026. The OAIC publishes updated Notifiable Data Breaches figures at least twice a year, and this post is scheduled for its own refresh on the same cadence.
